Skip to content

pt-show-grants

NAME

pt-show-grants - Canonicalize and print MySQL grants so you can effectively replicate, compare and version-control them.

SYNOPSIS

Usage

pt-show-grants [OPTIONS] [DSN]

pt-show-grants shows grants (user privileges) from a MySQL server.

Examples

pt-show-grants

pt-show-grants --separate --revoke | diff othergrants.sql -

RISKS

Percona Toolkit is mature, proven in the real world, and well tested, but all database tools can pose a risk to the system and the database server. Before using this tool, please:

  • Read the tool’s documentation

  • Review the tool’s known “BUGS”

  • Test the tool on a non-production server

  • Backup your production server and verify the backups

DESCRIPTION

pt-show-grants extracts, orders, and then prints grants for MySQL user accounts.

Why would you want this? There are several reasons.

The first is to easily replicate users from one server to another; you can simply extract the grants from the first server and pipe the output directly into another server.

The second use is to place your grants into version control. If you do a daily automated grant dump into version control, you’ll get lots of spurious changesets for grants that don’t change, because MySQL prints the actual grants out in a seemingly random order. For instance, one day it’ll say

GRANT DELETE, INSERT, UPDATE ON `test`.* TO 'foo'@'%';

And then another day it’ll say

GRANT INSERT, DELETE, UPDATE ON `test`.* TO 'foo'@'%';

The grants haven’t changed, but the order has. This script sorts the grants within the line, between ‘GRANT’ and ‘ON’. If there are multiple rows from SHOW GRANTS, it sorts the rows too, except that it always prints the row with the user’s password first, if it exists. This removes three kinds of inconsistency you’ll get from running SHOW GRANTS, and avoids spurious changesets in version control.

Third, if you want to diff grants across servers, it will be hard without “canonicalizing” them, which pt-show-grants does. The output is fully diff-able.

With the --revoke, --separate and other options, pt-show-grants also makes it easy to revoke specific privileges from users. This is tedious otherwise.

OPTIONS

This tool accepts additional command-line arguments. Refer to the “SYNOPSIS” and usage information for details.

--ask-pass

Prompt for a password when connecting to MySQL.

--charset

short form: -A; type: string

Default character set. If the value is utf8, sets Perl’s binmode on STDOUT to utf8, passes the mysql_enable_utf8 option to DBD::mysql, and runs SET NAMES UTF8 after connecting to MySQL. Any other value sets binmode on STDOUT without the utf8 layer, and runs SET NAMES after connecting to MySQL.

--config

type: Array

Read this comma-separated list of config files; if specified, this must be the first option on the command line.

--database

short form: -D; type: string

The database to use for the connection.

--defaults-file

short form: -F; type: string

Only read mysql options from the given file. You must give an absolute pathname.

--drop

Add DROP USER before each user in the output.

--flush

Add FLUSH PRIVILEGES after output.

You might need this on pre-4.1.1 servers if you want to drop a user completely.

--[no]header

default: yes

Print dump header.

The header precedes the dumped grants. It looks like:

-- Grants dumped by :program:`pt-show-grants` 1.0.19
-- Dumped from server Localhost via UNIX socket, MySQL 5.0.82-log at 2009-10-26 10:01:04

See also --[no]timestamp.

--help

Show help and exit.

--host

short form: -h; type: string

Connect to host.

--ignore

type: array

Ignore this comma-separated list of users.

--only

type: array

Only show grants for this comma-separated list of users.

--convert-MariaDB

Convert proprietary MariaDB syntax into valid MySQL form

--password

short form: -p; type: string

Password to use when connecting. If password contains commas they must be escaped with a backslash: “exam,ple”

--pid

type: string

Create the given PID file. The tool won’t start if the PID file already exists and the PID it contains is different than the current PID. However, if the PID file exists and the PID it contains is no longer running, the tool will overwrite the PID file with the current PID. The PID file is removed automatically when the tool exits.

--port

short form: -P; type: int

Port number to use for connection.

--revoke

Add REVOKE statements for each GRANT statement.

--separate

List each GRANT or REVOKE separately.

The default output from MySQL’s SHOW GRANTS command lists many privileges on a single line. With --flush, places a FLUSH PRIVILEGES after each user, instead of once at the end of all the output.

--set-vars

type: Array

Set the MySQL variables in this comma-separated list of variable=value pairs.

By default, the tool sets:

wait_timeout=10000

Variables specified on the command line override these defaults. For example, specifying --set-vars wait_timeout=500 overrides the defaultvalue of 10000.

The tool prints a warning and continues if a variable cannot be set.

--[no]include-unused-roles

When dumping MySQL 8+ roles, include unused roles.

--socket

short form: -S; type: string

Socket file to use for connection.

--[no]timestamp

default: yes

Add timestamp to the dump header.

See also --[no]header.

--user

short form: -u; type: string

User for login if not current user.

--version

Show version and exit.

DSN OPTIONS

These DSN options are used to create a DSN. Each option is given like option=value. The options are case-sensitive, so P and p are not the same option. There cannot be whitespace before or after the = and if the value contains whitespace it must be quoted. DSN options are comma-separated. See the percona-toolkit manpage for full details.

  • A

dsn: charset; copy: yes

Default character set.

  • D

dsn: database; copy: yes

Default database.

  • F

dsn: mysql_read_default_file; copy: yes

Only read default options from the given file

  • h

dsn: host; copy: yes

Connect to host.

  • p

dsn: password; copy: yes

Password to use when connecting. If password contains commas they must be escaped with a backslash: “exam,ple”

  • P

dsn: port; copy: yes

Port number to use for connection.

  • S

dsn: mysql_socket; copy: yes

Socket file to use for connection.

  • u

dsn: user; copy: yes

User for login if not current user.

  • s

dsn: mysql_ssl; copy: yes

Create SSL connection

ENVIRONMENT

The environment variable PTDEBUG enables verbose debugging output to STDERR. To enable debugging and capture all output to a file, run the tool like:

PTDEBUG=1 pt-show-grants ... > FILE 2>&1

Be careful: debugging output is voluminous and can generate several megabytes of output.

ATTENTION

Using <PTDEBUG> might expose passwords. When debug is enabled, all command line parameters are shown in the output.

SYSTEM REQUIREMENTS

You need Perl, DBI, DBD::mysql, and some core packages that ought to be installed in any reasonably new version of Perl.

BUGS

For a list of known bugs, see https://jira.percona.com/projects/PT/issues.

Please report bugs at https://jira.percona.com/projects/PT. Include the following information in your bug report:

  • Complete command-line used to run the tool

  • Tool --version

  • MySQL version of all servers involved

  • Output from the tool including STDERR

  • Input files (log/dump/config files, etc.)

If possible, include debugging output by running the tool with PTDEBUG; see “ENVIRONMENT”.

DOWNLOADING

Visit http://www.percona.com/software/percona-toolkit/ to download the latest release of Percona Toolkit. Or, get the latest release from the command line:

wget percona.com/get/percona-toolkit.tar.gz

wget percona.com/get/percona-toolkit.rpm

wget percona.com/get/percona-toolkit.deb

You can also get individual tools from the latest release:

wget percona.com/get/TOOL

Replace TOOL with the name of any tool.

AUTHORS

Baron Schwartz

ABOUT PERCONA TOOLKIT

This tool is part of Percona Toolkit, a collection of advanced command-line tools for MySQL developed by Percona. Percona Toolkit was forked from two projects in June, 2011: Maatkit and Aspersa. Those projects were created by Baron Schwartz and primarily developed by him and Daniel Nichter. Visit http://www.percona.com/software/ to learn about other free, open-source software from Percona.

VERSION

pt-show-grants 3.7.0